SY0-701 Question 167
Single answerResponsivenessA security operations center (SOC) receives an alert that a public-facing web application is intermittently unavailable. Initial investigation shows a sudden spike in HTTPS requests from thousands of IP addresses, causing legitimate users to experience timeouts. The company wants to improve responsiveness to this type of event so customer-facing services remain available while the incident is being handled. Which action should the security team implement FIRST?
- A
Activate rate limiting and upstream DDoS mitigation through the content delivery network (CDN) or ISP
- B
Reimage the web servers to ensure no malware is causing the outages
- C
Begin collecting forensic images from every affected system before making any changes
- D
Disable HTTPS inspection on perimeter devices to reduce processing overhead
Show answer and explanation
Correct answer: A
Explanation
This question focuses on responsiveness in incident response, specifically the ability to take timely action to maintain availability during an attack. In Security+ terms, a sudden flood of requests from many sources affecting a public-facing service is a classic indicator of a DDoS event. The most appropriate first step is containment that preserves business operations, such as rate limiting, traffic scrubbing, or engaging upstream protection through a CDN, WAF provider, or ISP. This aligns with common incident response guidance in NIST SP 800-61, which emphasizes containment strategies appropriate to the type of incident and business impact. For availability attacks, rapid traffic filtering and upstream mitigation are more responsive and practical than host-focused remediation or premature forensic collection.
- A. Correct.
Correct. In a distributed denial-of-service scenario, the immediate priority is service availability and rapid containment. Enabling rate limiting and upstream DDoS protections through a CDN, reverse proxy, or ISP helps absorb or filter malicious traffic before it overwhelms the organization's infrastructure. This is the most responsive first action because it directly addresses the ongoing availability impact while preserving the ability to continue investigation.
- B. Incorrect.
Incorrect. Reimaging is a recovery action that may be appropriate if compromise is confirmed, but the scenario indicates a volumetric traffic spike from many external IPs, which is more consistent with a DDoS attack than host malware. Reimaging does not address the immediate issue of malicious inbound traffic and would delay restoration of service.
- C. Incorrect.
Incorrect. Evidence collection can be important, but in an active availability attack, incident response best practices prioritize containment and service restoration first, especially for critical public-facing systems. Collecting forensic images from every system before mitigating the attack would slow response and is not the most effective initial step.
- D. Incorrect.
Incorrect. Disabling HTTPS inspection may reduce device load in some environments, but it does not stop a DDoS attack and may reduce visibility into malicious traffic. It also weakens security controls. This choice treats a symptom at the perimeter rather than implementing a proper availability-preserving mitigation.